@massu/core 1.10.8 → 1.12.1

package/src/detect/passthrough.ts

@@ -1,108 +0,0 @@
-// Copyright (c) 2026 Massu. All rights reserved.
-// Licensed under BSL 1.1 - see LICENSE file for details.
-
-/**
- * Shared passthrough helpers for config migration + refresh.
- *
- * These helpers exist to prevent the class of bug fixed in @massu/core@1.2.0
- * (incident 2026-04-19-config-upgrade-data-loss): a hand-maintained allow-list
- * in `migrate.ts` silently dropped any v1 top-level key not on the list, and
- * the parallel rebuild blocks inside `framework` / `paths` / `project` /
- * `python` did the same thing at the nested level.
- *
- * Both helpers are TARGET-WINS: the migrator writes the keys it actively owns,
- * then the helper fills in everything else the user had. A user-authored value
- * in `target` is NEVER overwritten by the source.
- *
- * Why two exports instead of one:
- *   - `copyUnknownKeys` takes an explicit `handledKeys` set — used for TOP-LEVEL
- *     passthrough where the caller enumerates the keys it migrated explicitly
- *     (e.g., schema_version, project, framework, paths, toolPrefix, …).
- *   - `preserveNestedSubkeys` takes no handled-set — used for NESTED passthrough
- *     where the target block was just rebuilt, so `k in target` already skips
- *     any key the rebuild populated. Splitting the two makes callsites
- *     self-documenting without a verbose `new Set()` argument at every nested
- *     call (A-002 architecture-review follow-up).
- */
-
-/** Keys that would mutate Object.prototype if copied as own properties. Explicit
- *  denylist defense-in-depth on top of the existing `k in target` guard and the
- *  `yaml@2.8` parser's non-polluting behavior (S-001 security-review follow-up). */
-const UNSAFE_KEYS: ReadonlySet<string> = new Set(['__proto__', 'constructor', 'prototype']);
-
-/**
- * Copy any key from `source` into `target` that target doesn't already have set,
- * skipping keys listed in `handledKeys`. Target values ALWAYS win — this function
- * never overwrites an existing target key.
- *
- * - If source[k] is undefined → skip (undefined is not a preservable value).
- * - If k is an UNSAFE_KEYS entry → skip (prototype-pollution defense).
- * - If handledKeys.has(k) → skip (caller has its own handling).
- * - If target already owns k → skip (target wins).
- * - Otherwise → target[k] = deepClone(source[k]).
- *
- * Values are DEEP-CLONED via structuredClone so that mutating the output v2
- * object never reaches back into the v1 input (S-002 security-review follow-up).
- * Preserves the migrator's "pure data in, pure data out" contract.
- */
-export function copyUnknownKeys(
-  source: Record<string, unknown>,
-  target: Record<string, unknown>,
-  handledKeys: ReadonlySet<string>
-): void {
-  if (source === null || typeof source !== 'object' || Array.isArray(source)) {
-    return;
-  }
-  for (const k of Object.keys(source)) {
-    if (UNSAFE_KEYS.has(k)) continue;
-    if (source[k] === undefined) continue;
-    if (handledKeys.has(k)) continue;
-    if (Object.prototype.hasOwnProperty.call(target, k)) continue;
-    target[k] = safeClone(source[k]);
-  }
-}
-
-/**
- * Preserve every subkey from sourceBlock into targetBlock that targetBlock
- * doesn't already have. Target values ALWAYS win.
- *
- * If sourceBlock is not a plain object (string, array, null, undefined),
- * return early — there are no subkeys to preserve. This matches the coercion
- * semantics of `getRecord` in migrate.ts and prevents throws on loose v1 inputs
- * like `framework: "typescript"`.
- *
- * Values are deep-cloned (see copyUnknownKeys); UNSAFE_KEYS are skipped.
- */
-export function preserveNestedSubkeys(
-  sourceBlock: unknown,
-  targetBlock: Record<string, unknown>
-): void {
-  if (
-    sourceBlock === null ||
-    sourceBlock === undefined ||
-    typeof sourceBlock !== 'object' ||
-    Array.isArray(sourceBlock)
-  ) {
-    return;
-  }
-  const src = sourceBlock as Record<string, unknown>;
-  for (const k of Object.keys(src)) {
-    if (UNSAFE_KEYS.has(k)) continue;
-    if (src[k] === undefined) continue;
-    if (Object.prototype.hasOwnProperty.call(targetBlock, k)) continue;
-    targetBlock[k] = safeClone(src[k]);
-  }
-}
-
-/** structuredClone with a fallback for environments without it (Node <17). */
-function safeClone<T>(v: T): T {
-  if (typeof structuredClone === 'function') {
-    try {
-      return structuredClone(v);
-    } catch {
-      // structuredClone throws on functions, DOM nodes, etc. — YAML never produces
-      // those, but if a caller passes something exotic, fall through to shallow.
-    }
-  }
-  return v;
-}

package/src/detect/regex-fallback.ts

@@ -1,449 +0,0 @@
-// Copyright (c) 2026 Massu. All rights reserved.
-// Licensed under BSL 1.1 - see LICENSE file for details.
-
-/**
- * Plan 3b — Phase 1: Regex Fallback Introspector.
- *
- * Verbatim move of the per-language regex helpers that were previously in
- * `codebase-introspector.ts` (Plan #2 P3-001). NO regex logic changes — only
- * the import path. This preserves Plan #2's 13 vitest cases as-is (re-imports
- * are updated in `codebase-introspector.test.ts` only if needed; the moved
- * functions retain their original signatures).
- *
- * The new 2-tier introspector (`codebase-introspector.ts`) calls these
- * functions ONLY for fields where AST adapters returned 'none' confidence.
- * AST adapters produce values into separate `detected.<adapter.id>` blocks;
- * regex output continues to go into `detected.python` / `.swift` /
- * `.typescript` blocks.
- *
- * Design rules carried over from Plan #2:
- *   - File size cap: 256KB per file (skip silently if larger).
- *   - Sample cap: at most 3 files per adapter (sorted, deterministic order).
- *   - Total wall-clock budget: <2s on a 10K-file repo.
- *   - Filesystem-only. No network, no child processes, no DB.
- *   - Returns `null` for any field it can't confidently extract.
- */
-
-import { existsSync, readdirSync, readFileSync, statSync } from 'fs';
-import { resolve, join, basename } from 'path';
-import type { DetectionResult } from './index.ts';
-
-export const MAX_FILE_BYTES = 256 * 1024;
-export const MAX_SAMPLES_PER_ADAPTER = 3;
-export const MAX_DIR_DEPTH = 6;
-
-// ============================================================
-// Public types (re-exported from codebase-introspector for compat)
-// ============================================================
-
-export interface DetectedPython {
-  auth_dep?: string;
-  api_prefix_base?: string;
-  test_async_pattern?: string;
-  _provenance?: Record<string, string>;
-}
-
-export interface DetectedSwift {
-  api_client_class?: string;
-  biometric_policy?: string;
-  _provenance?: Record<string, string>;
-}
-
-export interface DetectedTypeScript {
-  trpc_router_builder?: string;
-  procedure_pattern?: string;
-  _provenance?: Record<string, string>;
-}
-
-// ============================================================
-// Python adapter (FastAPI + Django)
-// ============================================================
-
-/**
- * Introspect Python sources. Probes both FastAPI router files (`routers/*.py`,
- * `api/*.py`) and Django views (`views.py`). Returns the most-extracted shape.
- */
-export function introspectPython(
-  detection: DetectionResult,
-  projectRoot: string,
-): DetectedPython | null {
-  const sourceDir = resolveSourceDir(detection, 'python', projectRoot);
-  if (!sourceDir) return null;
-
-  // Sample router-shaped files first (FastAPI / Flask), then views.py (Django),
-  // then any .py file as a last resort. Match on PATH, not just filename:
-  // FastAPI projects typically name routers by resource (`options.py`, `tax.py`)
-  // and place them under a `routers/` directory, so basename-only matching
-  // misses them. Also accept files where the basename itself is router-shaped
-  // (e.g., `endpoints.py`, `api.py`).
-  const routerFiles = sampleFiles(sourceDir, /\.py$/, (absPath, name) =>
-    /\/(routers?|api|endpoints?|views)\//.test(absPath) ||
-    /^(routers?|api|endpoints?)\.py$/.test(name),
-  );
-  const viewFiles = sampleFiles(sourceDir, /^views\.py$/);
-  const fallbackFiles = routerFiles.length === 0 && viewFiles.length === 0
-    ? sampleFiles(sourceDir, /\.py$/)
-    : [];
-  const candidates = [...routerFiles, ...viewFiles, ...fallbackFiles].slice(
-    0,
-    MAX_SAMPLES_PER_ADAPTER,
-  );
-
-  if (candidates.length === 0) return null;
-
-  const authDeps = new Map<string, string>(); // value → first source path
-  const prefixBases = new Map<string, string>();
-  const testAsyncPatterns = new Map<string, string>();
-
-  for (const path of candidates) {
-    const body = readSafe(path);
-    if (body === null) continue;
-
-    // Auth dependency: `Depends(<name>)` — capture the call's argument.
-    // ReDoS-safe: anchored, short window, no nested quantifiers.
-    const authRegex = /\bDepends\s*\(\s*([A-Za-z_][A-Za-z0-9_]*)\s*\)/gu;
-    forEachMatch(authRegex, body, m => {
-      const name = m[1];
-      if (!authDeps.has(name)) authDeps.set(name, path);
-    });
-
-    // Django: `@login_required` or `@permission_required` decorators.
-    const djangoAuthRegex = /^@\s*([a-z_][a-z0-9_]*(?:_required|_login))\b/gmu;
-    forEachMatch(djangoAuthRegex, body, m => {
-      const name = m[1];
-      if (!authDeps.has(name)) authDeps.set(name, path);
-    });
-
-    // API prefix base: `APIRouter(prefix="/api/...")` — capture just the BASE
-    // (everything up to the second `/` from the start).
-    const prefixRegex = /\bAPIRouter\s*\(\s*[^)]*?prefix\s*=\s*["']([^"']+)["']/gu;
-    forEachMatch(prefixRegex, body, m => {
-      const fullPrefix = m[1];
-      const base = extractPrefixBase(fullPrefix);
-      if (base && !prefixBases.has(base)) prefixBases.set(base, path);
-    });
-
-    // Test async pattern: `@pytest.mark.asyncio` (with possible parens).
-    const asyncRegex = /^(@pytest\.mark\.asyncio(?:\s*\([^)]*\))?)/gmu;
-    forEachMatch(asyncRegex, body, m => {
-      const pat = m[1].trim();
-      if (!testAsyncPatterns.has(pat)) testAsyncPatterns.set(pat, path);
-    });
-  }
-
-  const authDep = pickBestSingleton(authDeps);
-  const apiPrefixBase = pickBestSingleton(prefixBases);
-  const testAsyncPattern = pickBestSingleton(testAsyncPatterns);
-
-  const result: DetectedPython = {};
-  const provenance: Record<string, string> = {};
-
-  if (authDep) {
-    result.auth_dep = authDep.value;
-    provenance.auth_dep_source = relativeTo(projectRoot, authDep.source);
-  }
-  if (apiPrefixBase) {
-    result.api_prefix_base = apiPrefixBase.value;
-    provenance.api_prefix_base_source = relativeTo(projectRoot, apiPrefixBase.source);
-  }
-  if (testAsyncPattern) {
-    result.test_async_pattern = testAsyncPattern.value;
-    provenance.test_async_pattern_source = relativeTo(projectRoot, testAsyncPattern.source);
-  }
-
-  // Only emit a language block when at least one real field was extracted.
-  // An empty result (provenance-only) clutters the YAML for no value.
-  if (Object.keys(result).length === 0) return null;
-  if (Object.keys(provenance).length > 0) result._provenance = provenance;
-  return result;
-}
-
-/**
- * Reduce `/api/foo/bar` to `/api`. Returns null if the path doesn't have at
- * least one slash-segment.
- */
-function extractPrefixBase(prefix: string): string | null {
-  if (!prefix.startsWith('/')) return null;
-  const stripped = prefix.replace(/^\/+/, '');
-  const firstSeg = stripped.split('/')[0];
-  if (!firstSeg) return null;
-  return '/' + firstSeg;
-}
-
-// ============================================================
-// Swift adapter
-// ============================================================
-
-export function introspectSwift(
-  detection: DetectionResult,
-  projectRoot: string,
-): DetectedSwift | null {
-  const sourceDir = resolveSourceDir(detection, 'swift', projectRoot);
-  if (!sourceDir) return null;
-
-  // Prefer View files first, then any .swift. Path-aware: also match files
-  // under a `Views/` directory, since SwiftUI projects often name files by
-  // feature (e.g., `OrdersList.swift` inside `Features/Orders/Views/`).
-  const viewFiles = sampleFiles(sourceDir, /\.swift$/, (absPath, name) =>
-    /View\.swift$/.test(name) || /\/Views\//.test(absPath),
-  );
-  const fallbackFiles = viewFiles.length === 0
-    ? sampleFiles(sourceDir, /\.swift$/)
-    : [];
-  const candidates = [...viewFiles, ...fallbackFiles].slice(
-    0,
-    MAX_SAMPLES_PER_ADAPTER,
-  );
-
-  if (candidates.length === 0) return null;
-
-  const apiClasses = new Map<string, string>();
-  const biometricPolicies = new Map<string, string>();
-
-  for (const path of candidates) {
-    const body = readSafe(path);
-    if (body === null) continue;
-
-    // API client class: looks like `let api = SomeAPI()` or
-    // `@StateObject var api: SomeAPI = .shared` etc.
-    // Extract `SomeAPI` from `SomeAPI(`/`SomeAPI.shared`/`: SomeAPI`.
-    const apiRegex = /\b([A-Z][A-Za-z0-9_]*API)\s*(?:\(|\.shared|\b)/gu;
-    forEachMatch(apiRegex, body, m => {
-      const name = m[1];
-      if (!apiClasses.has(name)) apiClasses.set(name, path);
-    });
-
-    // LocalAuthentication policy: `LAPolicy.<name>` or `.<name>` after
-    // `evaluatePolicy(`. Whitelist known good values to avoid false positives.
-    const policyRegex = /\.(deviceOwnerAuthentication(?:WithBiometrics)?)\b/gu;
-    forEachMatch(policyRegex, body, m => {
-      const name = m[1];
-      if (!biometricPolicies.has(name)) biometricPolicies.set(name, path);
-    });
-  }
-
-  const apiClass = pickBestSingleton(apiClasses);
-  const biometricPolicy = pickBestSingleton(biometricPolicies);
-
-  const result: DetectedSwift = {};
-  const provenance: Record<string, string> = {};
-
-  if (apiClass) {
-    result.api_client_class = apiClass.value;
-    provenance.api_client_class_source = relativeTo(projectRoot, apiClass.source);
-  }
-  if (biometricPolicy) {
-    result.biometric_policy = biometricPolicy.value;
-    provenance.biometric_policy_source = relativeTo(projectRoot, biometricPolicy.source);
-  }
-
-  if (Object.keys(result).length === 0) return null;
-  if (Object.keys(provenance).length > 0) result._provenance = provenance;
-  return result;
-}
-
-// ============================================================
-// TypeScript / Next.js + tRPC adapter
-// ============================================================
-
-export function introspectTypeScript(
-  detection: DetectionResult,
-  projectRoot: string,
-): DetectedTypeScript | null {
-  const sourceDir = resolveSourceDir(detection, 'typescript', projectRoot)
-    ?? resolveSourceDir(detection, 'javascript', projectRoot);
-  if (!sourceDir) return null;
-
-  // Look for tRPC router files first. Match on PATH or filename: tRPC
-  // projects typically place routers under `server/api/routers/<name>.ts`
-  // where filenames are resource-named (e.g., `accounts.ts`).
-  const routerFiles = sampleFiles(sourceDir, /\.tsx?$/, (absPath, name) =>
-    /(router|trpc)/i.test(name) ||
-    /\/(routers|trpc|server\/api)\//.test(absPath),
-  );
-  const candidates = routerFiles.slice(0, MAX_SAMPLES_PER_ADAPTER);
-
-  if (candidates.length === 0) return null;
-
-  const builders = new Map<string, string>();
-  const procedurePatterns = new Map<string, string>();
-
-  for (const path of candidates) {
-    const body = readSafe(path);
-    if (body === null) continue;
-
-    // tRPC router builder: `createTRPCRouter({ ... })`. Whitelist known names
-    // (createTRPCRouter, router, t.router) — never grep for arbitrary identifiers.
-    const builderRegex = /\b(createTRPCRouter|router|t\.router)\s*\(/gu;
-    forEachMatch(builderRegex, body, m => {
-      const name = m[1];
-      if (!builders.has(name)) builders.set(name, path);
-    });
-
-    // Procedure pattern: `publicProcedure.input(...).query(...)` →
-    // capture just the procedure name (`publicProcedure`/`protectedProcedure`).
-    const procRegex = /\b([a-z]+Procedure)\b/gu;
-    forEachMatch(procRegex, body, m => {
-      const name = m[1];
-      if (!procedurePatterns.has(name)) procedurePatterns.set(name, path);
-    });
-  }
-
-  const builder = pickBestSingleton(builders);
-  const proc = pickBestSingleton(procedurePatterns);
-
-  const result: DetectedTypeScript = {};
-  const provenance: Record<string, string> = {};
-
-  if (builder) {
-    result.trpc_router_builder = builder.value;
-    provenance.trpc_router_builder_source = relativeTo(projectRoot, builder.source);
-  }
-  if (proc) {
-    result.procedure_pattern = proc.value;
-    provenance.procedure_pattern_source = relativeTo(projectRoot, proc.source);
-  }
-
-  if (Object.keys(result).length === 0) return null;
-  if (Object.keys(provenance).length > 0) result._provenance = provenance;
-  return result;
-}
-
-// ============================================================
-// Helpers
-// ============================================================
-
-/**
- * Resolve the dominant source directory for a language, falling back to the
- * project root if detection didn't surface anything specific.
- */
-function resolveSourceDir(
-  detection: DetectionResult,
-  lang: string,
-  projectRoot: string,
-): string | null {
-  const dirs = (detection.sourceDirs as unknown as Record<string, { source_dirs?: string[] }>);
-  const info = dirs[lang];
-  const list = info?.source_dirs ?? [];
-  if (list.length > 0) {
-    const first = list[0];
-    const abs = resolve(projectRoot, first);
-    return existsSync(abs) ? abs : null;
-  }
-  return existsSync(projectRoot) ? projectRoot : null;
-}
-
-/**
- * Walk `dir` and return up to MAX_SAMPLES_PER_ADAPTER files matching `nameRegex`,
- * filtered further by `pathFilter` (called with absolute path AND basename, so
- * filters can match either the filename (e.g., `views.py`) or a path
- * component (e.g., a `routers/` parent directory). Skips dot-dirs,
- * node_modules, .venv, etc. Bounded depth.
- */
-export function sampleFiles(
-  dir: string,
-  nameRegex: RegExp,
-  pathFilter?: (absPath: string, basename: string) => boolean,
-): string[] {
-  const out: string[] = [];
-  const stack: { path: string; depth: number }[] = [{ path: dir, depth: 0 }];
-
-  while (stack.length > 0 && out.length < MAX_SAMPLES_PER_ADAPTER * 4) {
-    const { path, depth } = stack.pop()!;
-    if (depth > MAX_DIR_DEPTH) continue;
-
-    let entries: string[];
-    try {
-      entries = readdirSync(path);
-    } catch {
-      continue;
-    }
-
-    for (const entry of entries) {
-      if (entry.startsWith('.')) continue;
-      if (entry === 'node_modules') continue;
-      if (entry === '__pycache__') continue;
-      if (entry === 'venv' || entry === '.venv') continue;
-      if (entry === 'dist' || entry === 'build') continue;
-
-      const child = join(path, entry);
-      let st;
-      try {
-        st = statSync(child);
-      } catch {
-        continue;
-      }
-
-      if (st.isDirectory()) {
-        stack.push({ path: child, depth: depth + 1 });
-        continue;
-      }
-
-      if (!nameRegex.test(entry)) continue;
-      if (pathFilter && !pathFilter(child, entry)) continue;
-      if (st.size > MAX_FILE_BYTES) continue;
-      out.push(child);
-      if (out.length >= MAX_SAMPLES_PER_ADAPTER * 4) break;
-    }
-  }
-
-  // Stable ordering — deterministic test fixtures.
-  out.sort();
-  return out.slice(0, MAX_SAMPLES_PER_ADAPTER * 2);
-}
-
-/** Read a file as UTF-8. Returns null on any error or if too large. */
-export function readSafe(path: string): string | null {
-  try {
-    const st = statSync(path);
-    if (st.size > MAX_FILE_BYTES) return null;
-    return readFileSync(path, 'utf-8');
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Run a global regex over `body` and call `cb` for each match. Caps iteration
- * at 1000 matches per regex to defend against pathological inputs.
- */
-export function forEachMatch(
-  re: RegExp,
-  body: string,
-  cb: (m: RegExpExecArray) => void,
-): void {
-  if (!re.global) return;
-  re.lastIndex = 0;
-  let count = 0;
-  let m: RegExpExecArray | null;
-  while ((m = re.exec(body)) !== null) {
-    cb(m);
-    count++;
-    if (count > 1000) break;
-    // Defensive: zero-width match → bump lastIndex to avoid infinite loop.
-    if (m.index === re.lastIndex) re.lastIndex++;
-  }
-}
-
-/**
- * If `samples` has exactly one distinct value, return it.
- * If it has 2 values, return the first-seen (stable, deterministic order from
- * file walk).
- * If it has 3+ distinct values, return null — Risk #6 (auth-dep ambiguity).
- */
-export function pickBestSingleton(
-  samples: Map<string, string>,
-): { value: string; source: string } | null {
-  if (samples.size === 0) return null;
-  if (samples.size >= 3) return null;
-  const [firstKey, firstSource] = samples.entries().next().value as [string, string];
-  return { value: firstKey, source: firstSource };
-}
-
-/** Make a file path relative to the project root. */
-export function relativeTo(projectRoot: string, absPath: string): string {
-  if (absPath.startsWith(projectRoot + '/')) {
-    return absPath.slice(projectRoot.length + 1);
-  }
-  return basename(absPath);
-}